PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Disable LLMNR via GPO (Together with NBT-NS and MDNS)

projectblack.io | research | #ai-security | #active-directory | #credential-theft | #gpo | #llmnr | #nbt-ns | #mdns
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How to disable LLMNR, NBT-NS and MDNS via GPO to stop attackers capturing password hashes through name-resolution fallback, with an importable GPO and cautions about MDNS side effects.
Published
Collected

Related coverage

blog · netspi.com
Inveigh – What's New in Version 1.4
Kevin Robertson details Inveigh 1.4, his PowerShell LLMNR/mDNS/NBNS spoofer, adding ADIDNS attacks, relay improvements with multiple target handling and BloodHound integration, plus evasion options.
research · projectblack.io
Password Policy GPO
After cracking ~40% of passwords in AD environments, the post recommends disabling forced expiry (max age 0), raising minimum length toward 16, and passphrase training — cutting crack rates to ~5%.
research · projectblack.io
Disable TLS 1.0 and 1.1 via GPO
Disabling TLS 1.0/1.1 (and Triple DES) on Windows via GPO: set the SCHANNEL protocol Enabled DWORDs to 0. The post notes this is server-side only and doesn't restrict outbound client connections.
research · projectblack.io
Disable WPAD via GPO
Most public guides to disabling WPAD, including Microsoft's, are incorrect; after the author reported this to MSRC, Microsoft updated its documentation. Covers the two registry keys and GPOs needed.
research · projectblack.io
Enable SMB Signing via GPO
Why 'SMB Signing not required' deserves attention: without signing, NTLM relay attacks grant access without cracking passwords. A GPO guide to enabling and requiring signing on servers and clients.
research · vercel.com
Everything hackable will get hacked
Open-weight models that allow perform offensive research present an emerging cybersecurity challenge. But you do not need to wait for specialized models to begin defensive cybersecurity work.
Back